4e36baf4f5f15aeaeaef020506919d98d4d503e3cc6b9113034d0b52c821ca7b | Triage

Sharing

Copy URL Twitter E-mail

General

Target

645f3ceef9b57cafeabe243093afc590_NeikiAnalytics
Size

71KB
Sample

240516-ax51gacb7y
MD5

645f3ceef9b57cafeabe243093afc590
SHA1

9cfff5efe026b1184a9e6ab2aa642f9b8e8b32f5
SHA256

4e36baf4f5f15aeaeaef020506919d98d4d503e3cc6b9113034d0b52c821ca7b
SHA512

25cbc24d9e424691b6ab7046ecf420f14f99f4c11d61e8c6ee07e151cd8a69dce831aa2968bd42c97353c7044dfc7d5a0c56b94ffa52a392a0af7e70c43f1d59
SSDEEP

1536:1teqKDlXvCDB04f5Gn/L8FlADNt3d1Hw8P:Olg35GTslA5t3/w8P

Score

10^/10

evasion persistence trojan

Malware Config

Targets

- Target
  
  645f3ceef9b57cafeabe243093afc590_NeikiAnalytics
- Size
  
  71KB
- MD5
  
  645f3ceef9b57cafeabe243093afc590
- SHA1
  
  9cfff5efe026b1184a9e6ab2aa642f9b8e8b32f5
- SHA256
  
  4e36baf4f5f15aeaeaef020506919d98d4d503e3cc6b9113034d0b52c821ca7b
- SHA512
  
  25cbc24d9e424691b6ab7046ecf420f14f99f4c11d61e8c6ee07e151cd8a69dce831aa2968bd42c97353c7044dfc7d5a0c56b94ffa52a392a0af7e70c43f1d59
- SSDEEP
  
  1536:1teqKDlXvCDB04f5Gn/L8FlADNt3d1Hw8P:Olg35GTslA5t3/w8P
Score

10^/10

evasion persistence trojan
- Windows security bypass
  evasion trojan
- Modifies Installed Components in the registry
  persistence
- Sets file execution options in registry
  persistence
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
  evasion trojan
- Modifies WinLogon
  persistence
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Defense Evasion

Impair Defenses

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistencetrojan

behavioral2

evasionpersistencetrojan